Apache Tomcat Directory Enumeration via .war Files (CVE-2015-5345)

Vulnerability Key Information Basic Information CVE Identifier: CVE-2015-5345 CVSS Score: 5.1 (Medium) CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C Affected Systems Apache Tomcat 9.0.0.M1 Apache Tomcat 8.0.0 to 8.0.29 Apache Tomcat 7.0.0 to 7.0.67 Apache Tomcat 6.0.0 to 6.0.44 Status of legacy (unsupported) Apache Tomcat versions is unknown Overview The Apache Tomcat application server, when a directory exists within an application's .war file, responds to HTTP requests with a redirect (appending a trailing slash). This allows remote unauthorized users to detect the presence of an application and map its internal structure via dictionary attacks. Impact The impact of this issue is limited. The existence of a web application can be detected, even if identification headers are disabled (by attempting to request the WEB-INF directory). Attackers can also determine whether a specific string within an application's .war file is a valid directory name. Solution Upgrade Apache Tomcat to at least the following versions: 9.0.0.M3, 8.0.30, 7.0.68, or 6.0.45. Technical Details When requesting a non-existent resource, Tomcat returns a 404 error. However, if a directory corresponding to the requested name exists within the application's .war file, Tomcat responds with a 302 redirect, appending a trailing slash to the request (which then returns 404). - - - -

Goal Reached Thanks to every supporter — we hit 100%!

Apache Tomcat Directory Enumeration via .war Files (CVE-2015-5345)